Hackers abuse npm mirrors to host phishing redirect pages

Threat actors are abusing npm and its mirror platforms to host malicious HTML pages that impersonate Cloudflare CAPTCHA verification, redirecting visitors to attacker-controlled websites. Security researcher inf0stache first spotted the technique in July, identifying a package called china_airlines that used a fake Cloudflare page to redirect visitors to a malicious domain. IntelFusions also reported on the activity. A later investigation by OX Security found 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors.

Unlike typical npm supply-chain attacks, installing these packages does not infect a developer’s computer with malware or infostealers. Instead, attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms such as UNPKG and npmmirror. Because some of these platforms allow individual files in npm packages to be accessed directly in a browser, they effectively turn developer sites into free web hosting for phishing pages. OX Security explained that the threat actor’s goal is not to infect developers who install the package, but to use the registry and its mirrors as safe, validated storage for the payload.

BleepingComputer examined one of the packages identified in the campaign and found it contained only two files: an index.html page and a package.json file declaring the HTML file as the package’s main file. When UNPKG mirrors the package, the HTML file can be opened directly in a browser via a URL from the legitimate unpkg.com domain. This causes the attacker’s HTML to render from a trusted domain rather than threat actor infrastructure, potentially bypassing security software that might block a malicious site. OX says this effectively turns npm mirrors into free frontend hosts for malicious HTML pages and potentially other payloads.

The malicious HTML impersonates a Cloudflare security verification page that embeds Cloudflare’s legitimate Turnstile CAPTCHA service. Regardless of whether verification succeeds, the page executes heavily obfuscated JavaScript that redirects the visitor to another site. OX Security research team lead Moshe Siman Tov Bustan told BleepingComputer that earlier versions redirected to microcloud[.]homes in July and login[.]microsofte[.]live in August. Some of the earliest July redirects ultimately resolved to the legitimate Microsoft Outlook mail login site at outlook.office.com.

BleepingComputer tested one of the malicious pages hosted through UNPKG and confirmed it still redirects visitors to that domain. The domain is not currently live, but it may be used to host a fake Microsoft login page. The researchers say other packages switched to a different redirect method using api.keyval.org, a legitimate platform for storing key-value pairs. The newer code retrieves an encrypted value from the service, decrypts it in the browser, and then redirects the visitor to the decrypted URL.

This allows the attackers to change the redirect URL remotely without modifying or republishing the npm package. At the time of OX’s research, the remotely configured destination redirected visitors to the legitimate ChatGPT website. While OX says the value could be changed at any time to point to ClickFix or other phishing pages, the npm-hosted HTML reviewed by BleepingComputer does not perform a ClickFix attack. These pages could also redirect visitors to phishing pages, malware downloads, or other attacker-controlled destinations.

OX also warns that npm packages may remain on mirrors after being removed from the official npm registry. The researchers concluded that threat actors keep finding new techniques to use legitimate infrastructure to store their payloads and data. They recommend treating direct HTML requests to npm mirror domains as potentially suspicious. For US technology users, this means that even trusted-looking URLs from developer platforms can serve phishing content, and security tools should not automatically trust files hosted on npm mirror domains.

More cybersecurity news from TechManNews.